Location Intelligence Management System

ABSTRACT

Collection and analysis of network transaction information which includes the mobile device&#39;s usage, location, movements coupled with data from non-wireless network sources allow for the automation of analysis for the detection of anti-social or criminal behaviors and tasking of high-accuracy location surveillance.

CROSS REFERENCE

This application is a continuation-in-part of U.S. application Ser. No.12/642,058, filed Dec. 18, 2009, currently pending, the content of whichis hereby incorporated by reference in its entirety.

TECHNICAL FIELD

The present invention relates generally to methods and apparatus forlocating wireless devices, also called mobile stations (MS), such asthose used in analog or digital cellular systems, personalcommunications systems (PCS), enhanced specialized mobile radios(ESMRs), and other types of wireless communications systems. Moreparticularly, but not exclusively, the present invention relates tousing location and identity information collected by wireless locationsystems (WLSs) and wireless communications networks (WCNs) to calculaterelationships between mobile subscribers and then managing locationgeneration resources based on location priorities, required quality ofservice and resource availability.

BACKGROUND

Location has always been a feature of mobile communications systems.With the advent of cellular radio systems, inherent in the functions ofthe wireless communications networks (WCNs) were the concepts of cell,sector, paging area and service area. These radio coverage areas createdwithin the WCN had a one-to-one correspondence to geographic areas, butwere of limited use in enabling location-based services outside of theprovision of communications between the mobile device and the WCN.

As part of the Personal Communications System (PCS) auction of 1994, theFederal Communications Commission, at the behest of public safetyagencies, added a requirement for the location of wireless emergencyservices calls for cellular and PCS systems. The FCC's wireless Enhanced9-1-1 (E9-1-1) rules were designed to improve the effectiveness andreliability of wireless 9-1-1 services by providing 9-1-1 dispatchersand public safety agencies with geographic location information onwireless 9-1-1 calls. Location accuracy varied from the E9-1-1 Phase Irules which required that the existing WCN developed locationinformation be converted to a geographic representation and madeavailable to public safety agencies. Phase II of the FCC E9-1-1 rulescalled for high-accuracy location of emergency services wireless calls.Eventually both network-based and mobile-based techniques were fieldedto satisfy the E9-1-1 Phase II high accuracy location mandate.

As realized and noted in extensive prior art, the ability to routinely,reliably, and rapidly locate cellular wireless communications deviceshas the potential to provide significant public benefit in public safetyand convenience and in commercial productivity. In response to thecommercial and governmental demand a number of infrastructure-based,handset-based and network-based wireless location systems have beendeveloped.

Infrastructure-based location techniques use information in use withinthe WCN to generate an approximate geographic location.Infrastructure-based location techniques include CID (serving Cell-ID),CID-RTF (serving cell-ID plus radio time-of-flight time-based ranging),CIDTA (serving cell-ID plus time-based ranging), and Enhanced Cell-ID(ECID, a serving cell, time-based ranging and power difference ofarrival hybrid). Signals that generate the WCN information that is theprecursor to infrastructure-based location may be collected at thehandset or at the base station and delivered to a mobile location serverwhich has databased knowledge of both the WCN topology and geographictopology.

Network-based location solutions use specialized receivers and/orpassive monitors within, or overlaid on, the wireless communicationsnetwork to collect uplink (mobile device-to-base station) signals, whichare used to determine location and velocity of the mobile device.Overlay Network-based techniques include uplinkTime-Difference-of-Arrival (TDOA), Angle-Of-Arrival (AOA), MultipathAnalysis (RF fingerprinting), and signal strength measurement (SSM).Examples of network-based systems for the determination of locations forwireless mobile units are found in Stilp, et al., U.S. Pat. No.5,327,144; Stilp, et al., U.S. Pat. No. 5,608,410; Kennedy, et al., U.S.Pat. No. 5,317,323; Maloney, et al., U.S. Pat. No. 4,728,959; andrelated art.

Mobile-device based location solutions use specialized electronicsand/or software within the mobile device to collect signaling. Locationdetermination can take place in the device or information can betransmitted to a landside server which determines the location.Device-based location techniques include CID (serving Cell-ID), CID-RTF(serving cell-ID plus radio time-of-flight time-based ranging), CIDTA(serving cell-ID plus time-based ranging), Enhanced Cell-ID (ECID, aserving cell, time-based ranging and power difference of arrivalhybrid), Advanced-Forward-Link-Trilateration (AFLT), Enhanced ObservedTime Difference (E-OTD), Observed-Time-Difference-of-Arrival (OTDOA) andGlobal Navigation Satellite System (GNSS) positioning. An example of aGNSS system is the United States NavStar Global Positioning System(GPS).

Hybrids of the network-based and mobile device-based techniques can beused to generate improved quality of services including improved speed,accuracy, yield, and uniformity of location. A wireless location systemdetermines geographic position and, in some cases, the speed anddirection of travel of wireless devices. Wireless location systems useuplink (device-to-network) signals, downlink (network-to-device)signals, or non-communications network signals (fixed beacons,terrestrial broadcasts, and/or satellite broadcasts). Network-basedlocation solutions use specialized receivers and/or passive monitorswithin, or overlaid on, the wireless communications network to collectsignaling used to determine location. Network-based techniques includeuplink Time-Difference-of-Arrival (TDOA), Angle-Of-Arrival (AOA),Multipath Analysis (RF fingerprinting), and signal strength measurement(SSM). Hybrids of the network-based techniques can be used to generateimproved quality of services including speed, accuracy, yield, anduniformity of location.

The use of collateral information supplied to the Wireless LocationSystem from the Wireless Communications Network or off-line databased toenable or enhance location determination in network-based systems wasintroduced in Maloney, et al., U.S. Pat. No. 5,959,580; and furtherextended in Maloney, et al., U.S. Pat. Nos. 6,108,555 and 6,119,013.These and related following descriptions of the prior art forinfrastructure-based location determination systems enable robust andeffective location-determination performance when adequate measurementdata can be derived or are otherwise available.

Since the advent of direct dial cellular telecommunications in 1984, andespecially in the past decade, the cellular industry has increased thenumber of air interface protocols available for use by wirelesstelephones, increased the number of frequency bands in which wireless ormobile telephones may operate, and expanded the number of terms thatrefer or relate to mobile telephones to include “personal communicationsservices,” “wireless,” and others. Also, data services, such asshort-message-service (SMS), packet data services (for example the GPRS(GSM General Packet Radio Service) and IP Multimedia Subsystem (IMS)have proliferated as has the number and variety of voice, data andvoice-data capable wireless devices.

The air interface protocols now used in the wireless industry includeAMPS, N-AMPS, TDMA, CDMA, TS-CDMA, OFDM, OFDMA, GSM, TACS, ESMR, GPRS,EDGE, UMTS, WCDMA, WiMAX, LTE, LTE-A and others.

The term CDMA will be used to refer to the CDMA digital cellular(TIA/EIA TR-45.4 defined IS-95, IS-95A, IS-95B), Personal CommunicationsServices (J-STD-008), and 3GPP2 defined CDMA-2000 and UMB standards andair interfaces. The term UMTS will be used to refer to the 3GPPspecified Wideband-CDMA (W-CDMA) based Universal MobileTelecommunications System, defining standards, and radio air interface.The term WiMAX is used to denote the IEEE defined 802.16, “BroadbandWireless”; 802.20, “Mobile Broadband Wireless Access”; and 802.22,“Wireless Regional Area Networks” technologies. The present inventionalso applies to the 3GPP defined Long-Term-Evolution (LTE) and the 3GPPLTE-Advanced (LTE-A) system among others.

For further background information relating to the subject matterdescribed herein, the reader may refer to the following patents andpatent applications assigned to TruePosition Inc., or TruePosition'swholly owned subsidiary, KSI: U.S. application Ser. No. 11/965,481entitled “Subscriber Selective, Area-based Service Control” (theentirety of which is hereby incorporated by reference) which is acontinuation-in-part of U.S. application Ser. No. 11/198,996 entitled“Geo-fencing in a Wireless Location System”, which is a continuation ofSer. No. 11/150,414, filed Jun. 10, 2005, entitled “Advanced Triggersfor Location-Based Service Applications in a Wireless Location System”,which is a continuation-in-part of U.S. application Ser. No. 10/768,587,filed Jan. 29, 2004, entitled “Monitoring of Call Information in aWireless Location System”, now pending, which is a continuation of U.S.application Ser. No. 09/909,221, filed Jul. 18, 2001, entitled“Monitoring of Call Information in a Wireless Location System,”, nowU.S. Pat. No. 6,782,264 B2, which is a continuation-in-part of U.S.application Ser. No. 09/539,352, filed Mar. 31, 2000, entitled“Centralized database for a Wireless Location System,” now U.S. Pat. No.6,317,604 B1, which is a continuation of U.S. application Ser. No.09/227,764, filed Jan. 8, 1999, entitled “Calibration for WirelessLocation System”, and U.S. Pat. No. 6,184,829 B1. Maloney, et al., U.S.Pat. No. 5,959,580; Maloney, et al., U.S. Pat. No. 6,108,555 andMaloney, et al., U.S. Pat. No. 6,119,013. Each of these is herebyincorporated by reference in its entirety.

SUMMARY

A Location Intelligence Management System (LIMS) is a data capture,storage and decision support system that utilizes available data (bothpast and real time) from multiple sources (such as wireless networks,wireless location network, and off line sources such as networkinformation, geographic information, manually entered information andgeo-spatial data) to optimize utilization (scheduling and selection) ofwireless location resources across multiple users and entities toproduce location-aware intelligence. The LIMS contains the algorithms,control logic, data storage, processors and input/output devices toanalyze past and real time data obtained from multiple sources incombination or separately, to produce intelligence in the form ofmetadata not otherwise reasonably or easily obtained. These algorithmscan iteratively use previous generated metadata to automaticallycontribute to new analysis, which will use both real data (past and realtime) as well as metadata. Such analysis would produce information suchas: identifying potential behaviors of interest, identifying specificmobile users associated with such behaviors of interest, associationsbetween mobile device users and mobile device user identification whenno public ID is available (such as with prepaid mobile devices). TheLIMS can then manage Position Determining Equipment (PDE) locationresource utilization based on a combination of factors including but notlimited to location priority, location accuracy, wireless locationsystem(s) capacity, the geographic distribution of PDEs, terrain,man-made information (known tunnels, buildings, bridges, etc.), networkinformation (cell distribution, coverage, network topology, networkstatus, etc.), for performing locations on traffic channels, controlchannels and data sessions.

In an illustrative embodiment, a LIMS comprises a controller computer, afirst database configured to store network event historical data, and asecond database configured to store metadata. The LIMS is configuredwith computer software to utilize data from multiple sources to producelocation-aware intelligence. This includes the creation of geo-profilesfor mobile devices. The geo-profiles include location and timeinformation for the mobile devices.

Such geo-profiles can be analyzed to detect aberrant or potentiallyaberrant behaviors, or what we refer to as “behaviors of interest,” or“behavior-based triggers”. For example, as described below, an aspect ofthis embodiment is the LIMS' capability to detect behaviors of interestand identify specific mobiles or mobile users associated with suchbehaviors of interest. These behavioral complex triggers use the LIMScapabilities that allow radio or network events corresponding tospecific messages or groups of messages to generate high and/or lowaccuracy location estimates. A triggering event that initiates locationestimation may be a detection of a particular message or a field withina specific message. Over time, a database of historical informationincluding mobile identifiers and triggered events is developed(collection phase). The data collection phase may target any mobiledevice, any set of mobile devices, or a specific area in the wirelesscommunications network (WCN) service area. Selection of a mobile devicemay be by any of the detectable mobile or network identifiers associatedwith the mobile device. Data from the collection phase is then analyzedfor suspect behaviors and an index probability is assigned to eachmobile. The analysis phase may include information imported fromoff-line sources and may be performed periodically, ad hoc in responseto a set triggering event, or manually at any time. Illustrativeexamples of advanced LIMS scenarios include area presence determination,association by proximity, detection of avoidance tactics, and generalsurveillance using secondary triggers. Additional aspects in theinventive subject matter are described below.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing summary as well as the following detailed description isbetter understood when read in conjunction with the appended drawings.For the purpose of illustrating the invention, there is shown in thedrawings exemplary constructions of the invention; however, theinvention is not limited to the specific methods and instrumentalitiesdisclosed. In the drawings:

FIG. 1 schematically depicts a high level LIMS system in relation toother system nodes.

FIG. 1 a depicts an example LIMS system as instantiated in a GERAN-basedwireless communications network.

FIG. 2 illustrates functional subsystems of the LIMS system.

FIG. 3 shows the process flow for a specific LIMS enabledapplication—command controlled Improvised Explosive Device discovery anddisablement.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

We will now describe illustrative embodiments of the present invention.First, we provide a detailed overview of the problem and then a moredetailed description of our solutions.

FIG. 1 illustrates the LIMS as deployed in a generic wirelesscommunications Network (WCN). The Radio Access Network (RAN) 101provides the radio link between the mobile device and the Core Network102. Examples of a RAN network can include the Global System forMobility (GSM), iDEN, Tetra, Universal Mobile Telephone System (UMTS),WiMAN, WiMAX, Long-Term-Evolution (LTE), Generic Access Network (GAN),and the IS-95/IS-2000 family of CDMA protocols among others. The CoreNetwork provides the basic switching, routing, transcoding, metering,and interworking needed to connect and bill mobile-to-land,land-to-mobile, and mobile-to-mobile connections. The core networkconnects to landside networks and other mobile networks via the PublicInterconnection Network 103 (nominally a SS7 network with trunking forcircuit switched connections or a TCP/IP network for digital packet dataconnections.

The LIMS 108 subsystem is connected to the RAN 101 and Core Network 102via the Link Monitoring System (LMS) 106. As disclosed in TruePositionU.S. Pat. No. 6,782,264, Aug. 24, 2004, “Monitoring of Call Informationin a Wireless Location System,” and U.S. Pat. No. 7,167,713 “Monitoringof Call Information in a Wireless Location System” and then expanded inU.S. Published Patent Application 20060003775, filed Jun. 10, 2005,“Advanced Triggers for Location-based Service Applications in a WirelessLocation System,” an Abis Monitoring System (AMS) or Link MonitoringSystem (LMS) 106 can be deployed in conjunction with the wirelesslocation system to supply a passive means of triggering and tasking thewireless location system. As cost savings measures, an LMS 106 may bedeployed to monitor the Abis (BTS-to-BSC) link only or the required LMSfunctionality may be incorporated directly into the BSC. Fullfunctionality of the LMS in identifying wireless transactions, networktransactions, mobile identifiers, and subscriber identifiers requiresthat the example GSM network, the A, Abis, and GSM-MAP interfaces, bemonitored. The LMS 106 functionality can be deployed as a network ofpassive probes reporting back to a central server cluster or as asoftware-based application for inclusion in wireless infrastructure, forexample, the Base Station Controller (BSC) or Radio Network Controller(RNC). The LMS 106 connects to the RAN 101 via a digital data connection104 and to the Core Network 102 via a digital data connection 105. TheLMS 106 connects with the LIMS 108 via a digital data connection 111.The LMS 106 may optionally connect with the Position Determining Entity114 via a digital data connection 115 in cases where triggers andfilters, and priorities pre-set in the LMS 106 by the LIMS 108 require aminimum latency in initiation of the location signal collection andcalculation.

The LIMS 108 is a set of generic computer servers and routers runningspecialized interconnected software applications and databases. The LIMS108 connects via digital data links 112 113 to multiple databases whichat minimum include a network event historical database 110 and ametadata database 109. The LIMS 108 is a decision support system thatdetermines when and how accurate a specific wireless location needs tobe and where to best obtain it from given current conditions (forexample, how busy different PDEs are or the concentration of concurrentrequests for locations in a given geographic area). The LIMS thenmanages PDE 114 location resource utilization based on a combination offactors including but not limited to: priority, accuracy, system(s)capacity, geographic distribution of PDEs, terrain, man-made information(such as, known tunnels, buildings, bridges), network information (celldistribution, coverage, network topology, network status), forperforming locations on traffic channels, control channels and datasession locations. Information on man-made features may includeelevation and altitude data. Man-made features include transportationstructures (bridges, overpasses, tunnels) as well as industrial andhabitable structure information.

The LIMS 108 manages location resources based on prioritization level,resource availability, and demanded location quality of service. TheLIMS 108 contains a decision support system (DSS) software applicationto automatically decide when to require a high accuracy location versusa lower accuracy location which does not require potentially limited PDE114 location resources. The DSS application uses rules, databasedlocation, identity, and transactional information (network or mobileevents, time of day, geo-fence boundaries) to determine a set ofscenarios based on a prioritized set of situational issues that generatemetadata (which is stored in a metadata database) such as relationshipsbetween users, mobile devices, locations of interest and other mobiledevices. Using the multidimensional histograms of activity and locationswith dynamic conditional logic, the LIMS can determine association byproximity which can then be used as a triggering event or use locationas a proxy to identity (metadata) users and relationships between users,groups and locations of interest. In setting the automatic real-time,high-accuracy location of mobile devices, the metadata analysis is usedby the DDS application to compile an iterative, “Risk profile”,escalating number on accumulation of weighted patterns and factors foreach device, Mobiles with a high risk threshold, as determined bybehaviors e.g. such as entry or exit to secured areas, communicationwith or proximity to known suspects, or communication patternsindicative of known avoidance patterns, are subjected to additionalscrutiny and potentially flagged to users.

The LIMS 108 receives infrastructure-generated tasking information enmass from the LMS 106 to obtain data for real time processing ofcurrently running algorithms, to populate the network event historicaldatabase 110 for future analysis as well as details required to enablethe network based location system (PDE) to perform higher accuracylocations as required. The network event historical database 110contains all events from all “simple” triggers set in the LMS, theseevents include mobile identifiers (such as IMSI, IEMI, MS-ISDN, TMSI)event details (such as called number, calling number, message type) aswell as location information gleaned from the wireless networkparameters obtained from the event reports. The LIMS 108 creates its owncomplex triggers from the combination of the real time flow of mass datainto the operating algorithms, use of past network event historical data110 and past metadata database 109 and use of the DSS that optimized PDEutilization previously mentioned.

Examples of the LIMS 108 capabilities enabled by the network eventhistorical database 110 include geo-profile (locations and events as afunction of time, probability and pattern analysis) determination,associations by proximity (correlation between two or more devices basedon location proximity as a function of time and based on probability andpattern analysis in consideration of accuracy and other factors) basedon histograms and conditional logic, detection of past patterns ofevasive behavior (such as SIM swapping, use of multiple SIMs by the sameuser, use of multiple phones carried by the same user, turning mobiledevices on only briefly, turning mobile devices off and on at specificlocations frequently). The LIMS 108 can use a mobile's calling patternand history for analysis, but more importantly, it can use non callrelated information such as registrations and location updates foradditional analysis to build improved geo-profiles and associations byproximity to then recognize suspicious behavior and events. The networkevent historical database 110 includes records on both messaging-relatedand WCN control events like location updates, handovers, power up IMSIattaches and power down de-registrations). Additionally, informationfrom the metadata database 109 (containing non-wireless, non-transmittedor generated information) can be also be used in the decision matrix.For example, user entered information on geographic areas of interest,known special terrain conditions or specific case information can beused to add additional intelligence for filtering and correlativeanalysis. Additionally, the metadata database 109 contains datagenerated from past execution of algorithms (such as geo-fenceoperations, targeted surveillance activity) is maintained and can beused.

A geo-profile is created for each mobile device and will include thelocation of the mobile as a function of time for a specific time rangeor area of interest. Such geo-profile is metadata that is created fromnetwork transactions (single to multiple) monitored by the LIMS platformas well as from off-line sources and LIMS created meta-data derived frompost-processing analysis and multi-transaction complex triggers. When ageo-profile of a mobile is focused on a specific area of interest, thisis called a geo-fence profile.

For instance, a geo-fence profile can include where a mobile spent timein or out of a specific geographical area is recorded as a function oftime, or as a time value as a function of area.

For each network transaction monitored, a network transaction record(NTR) is created and appended to the geo-profile. Analysis of thecontents of the NTR may be in real-time or performed in apost-processing stage. The timing and priority of analysis may be basedon any field in the NTR. Results of the analysis are then added to thegeo-profile.

An example of the NTR is shown in Table 1 and illustrative details ofthe record are shown in Table 2. Exact details of the NTR contents aredependent on the probe system deployed. For instance, a wirelesscommunications network based software-based probe (located in the GSMBase Station Controller, the UMTS Radio Network Controller, or the LTEServing Gateway Mobility Management Entity) may deliver differentinformation then a passive overlay/independent probe network.

TABLE 1 Network Transaction Record TS ID KEY TRIG EV Cell EXT LOC NAMEGEO RISK

TABLE 2 Network Transaction Record Detail TS—this is the timestamp datafor the triggering event ID—this is the collected identificationinformation for the mobile device (e.g. MSISDN, IMSI, IMEI, TMSI)KEY—Any information for the network transaction that includes EncryptionKey data (either collected by or delivered to the LIMS) TRIG—The indexto the triggering event EV—The Event(s) descriptor and details. This isin addition to the triggering information and can include called number,calling number, location area CELL—this field includes data about thewireless communications network. Example data includes serving Cell ID,Serving Cell Location, Serving Network Name, Network ID, Country Code,Country, Wireless Operator technology, and available LocationTechnology. EXT—Extended information on WCN radio link such as timingparameters (e.g. Timing advance, Round Trip Time or Serving-One-Way-Delay) and link power (e.g. Measurement Reports, Network MeasurementReports, Code Power Measurements, or Pilot Strength Measurements). Bothuplink and downlink information on the radio link LOG—When a location istriggered, the Mobile Device location, velocity and uncertainties forlocation and velocity are stored. GEO—Includes geofence information ifmobile is interacting with a set Geo-fence area or boundary. This fieldincludes GeoFence Name, Geofence breach, breach direction, Breach Type,Breach Frequency, Breach time. RISK—A risk parameter is set for eachmobile device and is set on the basis of each event, and each geo-fence.This field is incremented and decremented in accordance to the rules andpriorities set by the LIMS operator.

In the U.S. Pat. No. 7,783,299, issued Aug. 24, 2010, entitled “AdvancedTriggers for Location-Based Service Applications in a Wireless LocationSystem”, TruePosition introduced the basic concept of triggers allowingfor the monitoring of WCN for events and transactions that wouldautomatically cause a location attempt based on the pre-set triggers.Use of the LIMS 108 with its decision support system (DSS) andhistorical and metadata database(s) enable a new class of triggers basedon an additional layer of logic and filtering based on historical oroff-line data. The basic trigger delivered information and other data isprocessed by the DSS with a set of if-then-else rules combined withdatabased information on events, time-of-day, and geofence boundaries tocreate a database of metadata. The newly created metadata allows theLIMS to perform analysis where the location of a mobile is used as aproxy to identity, purpose and relationships with other mobile users.The same metadata can be used to enhance forward looking algorithmswhich in turn produce new complex triggers.

An example of a complex trigger than uses network event historicaldatabase 110 in conjunction with real time network information is a whentwo or more mobile devices exhibit the same location behavior over aperiod of time, such as being co-located while moving around for periodsof time, implying they are traveling together, but there is noinformation in the historical database indicating they ever interactwith each other (e.g. voice call, connection via data session orShort-Message-Service (SMS)). Then, the LIMS can decide to utilize highaccuracy PDE resources to further verify or dispute this heuristicinformation. Such high accuracy locations would be based on real timenetwork events, either passive or actively generated to determinelocation of said subjects at the same point in time. This can remain inoperation for extended periods of time to increase confidence in thecorrelation.

Another example is the automatic detection of SIM swapping based onhistorical data as compared to the real time data coming in from thenetwork. Once detected, the LIMS can then decide to trigger the PDE tolocate the mobile(s) using high accuracy at that point in time or on acontinuous basis depending on the user conditions set up in the LIMSsuch as location area where this occurs, time and day constraints,proximity to other known mobile devices, etc. Automatic use of highaccuracy location helps build up a set of high accuracy information inthe metadata database for a set of high risk mobile devices and theirusers for future correlation with other mobile devices, public events(such as crimes, public gatherings, etc.) sites and points of interest(such as tunnel entry/exit point, overlook observation points) as thehigh accuracy resources are limited and cannot be provided for everymobile and every network event.

Network Event historical database 110 (may actually be one or moredatabases) contains information on every network event transaction thatoccurs in the covered area for all mobile devices as configured. Thiscould be reduced to a specific set of mobile devices via a list ofidentifiers for inclusion only or exclusion only. Said database containsselected information for each event including all available knownidentifiers of the specific mobile (one or more of the following: TMSI,IMSI, IMEI, MSISDN). It also includes event related informationincluding the event type (such as hand over, mobile originated call, SMSreceived, etc.) and related event data such as dialed digits andtimestamps. Additionally, each event contains relevant networkinformation depending on the network type (cell site and TA for GSM, CIand SAI for UMTS, etc.). The network event historical database alsoincludes some metadata for each specific event (not related to otherevents or combinations) which includes a calculated X,Y location basedon best available location processing (including high accuracy) as wellas additional identifiers populated (such as MSISDN) that may not haveactually existed in the network event but are known to belong to thesaid mobile device through correlation previously provided in the LMS orLIMS.

Metadata database 109 (may actually be one or more databases) containsinformation that is input by users (manually or automatically) andinformation that is produced as a result of processes or algorithms onthe LIMS 108. User input data can contain maps information including butnot limited to streets, terrain, clutter, buildings, foliage, tunnels,pipelines, facilities (airports, bases), sites or areas of interest(such as buildings or border crossings points or geo-fence definitions),can also contain network information including but not limited to cellsite locations, antenna sizes, azimuths, directions, down tilt, caninclude high accuracy location results for specific algorithms that haverun in the past (such as geo-fence operations or surveillanceoperations) as well as specific information related to conditions andparameters used in past algorithm runs.

LIMS Platform in GERAN Network

FIG. 1 a details functional nodes of an illustrative embodiment of theLIMS platform and associated subsystems installed into a GERAN (GSM withGPRS) network.

The metadata (data about data) database 109 contains informationobtained results of analysis performed by the LIMS automated processesor by the LIMS operators on data acquired from the LMS's collectednetwork transaction messaging and/or acquired from other databases andsources. Examples of metadata include associations between mobilesincluding past proximity and calling patterns. Past assessments ofrisk/threat levels are profiled here. The metadata could usemultidimensional indexing allowing for storage and retrieval of datasuch as coincident timing and proximity to events, mobiles or locationsof interest, mobile equipment or mobile identity changes, andassociations between mobile users.

The historical database 110 contains the records (which include mobileidentifier, timestamp, and cellular network location (CGI, CGI withranging)) obtained via the LMS or from the cellular network.

The BTS (Base Transceiver Station) 117 is the GSM-defined distributedradio point of connection for the GSM radio air interface 157 network.The BTS is also responsible for encryption/decryption of data sent overthe air interface.

The BSC (Base Station Controller) 118 handles radio resource management,such as frequency allocation and handovers, and in some casestranscoding and multiplexing tasks. Data streams are routed through theBSC 118 via the packet control unit to the SGSN 119 while voice circuitsare routed to the MSC 120.

The SGSN (Serving GPRS Support Node) 119 provides session and mobilitymanagement for GPRS-equipped mobile devices. The SGSN 119 also serves asa router for transport of packet data streams to and from GPRS-equippedmobile devices.

The MSC 120 provides session and mobility management for GSM mobiledevices. The MSC 119 also supports basic voice circuit switching tasksand as interface to Intelligent Networking and other SS7 networkinterconnected subsystems.

The Visitor Location Register (VLR) (not shown), a dynamic database ofuser account information downloaded from various HLRs 121, is typicallyco-located on the MSC 120 computing platform.

The HLR (Home Location Register) 121 is primarily a database of useraccount information of a wireless carrier's customers. The user accountdatabase contains billing information, status, current/last knownnetwork address and services preferences.

The GMLC (Gateway Mobile Location Center) 122 is the gateway, bridge,and router for location services. IP-based interfaces such OMA-definedMLP or Le interface are interconnected via the GMLC 112 to the SS7network-based nodes over such interfaces as the Lg interface (to MSC120), Lc interface (to SCP (not shown), or Lh interface (to HLR 121)interface. Basic administration, authentication, accounting and accesscontrol functions for location services may also be implemented on theGMLC 122. The GMLC 112 may be used by the LIMS 140 to ping an idlemobile 157 via the standardized AnyTimeInterrogation procedure or SMStype 0 which silently pages the idle mobile so it resumes contact withthe wireless network to exchange control channel signaling.

The Abis interface 123 carries data and control information between theBTS 117 and BSC 118. The Abis interface 123 is optional as the BTS 117and BSC 118 may be combined.

The Gb interface 124 carries data and control information between theBSC 118 and the SGSN 119.

The A interface 125 carries data and control information between the BSC118 and the MSC 120.

The Ga Interface 126 interconnects the SGSN 126 with the Gateway GPRSSupport Node (GGSN—not shown) and the Public Data Network (PDN) 159.

Switch Circuit Trunks 127 interconnect the Public Telephone SwitchedNetwork (PTSN) 160 with the MSC 120 switching facilities.

The SGSN 119 SS7 network interconnection 128 includes the Gr Interfaceused to interconnect the SGSN 119 with the HLR 121 for requesting ofuser information and updating of network location and the Lg Interfaceused to communicate with the GMLC for location tasking andAnyTimeInterrogation or sending of an SMS type 0 to idle mobile devices.

The MSC 120 SS7 Network interconnection 129 includes the D Interfaceused to interconnect the MSC 120 with the HLR 121 for requesting of userinformation and updating of network location and the Lg Interface usedto communicate with the GMLC for location tasking andAnyTimeInterrogation or sending of an SMS type 0 to idle mobile devices.

The MAP/CAP Network 130 is used here to show the international SS7packet network used to connect SS7 nodes in the Core Network 102. MAP(Mobile Application Part) is the control information sent between nodeswhile CAP (CAMEL Application Part) is the Intelligent Networks protocolused to enable telephony and database services. The Gr, Lg, Lh, and Dinterfaces (among others not shown) all traverse the SS7 network.

The LMU (Location Measurement Unit) 131 is the geographicallydistributed radio receiver network used to collect uplink (mobile 157 toBTS 117) radio signals for use in network-based location techniques(TDOA, AoA, TDOA/AOA) or TDOA/GNSS hybrid location calculation.

The Wireless Location Processor (WLP) 132 manages the LMU network 131,schedules the LMUs 131 for signal collection and calculates Uplink TimeDifference of Arrival (U-TDOA), Angle of Arrival (AOA), or HybridLocation Solution (HLS) location estimates.

The WLG 133 receives triggers from the LIMS 137, LMS 136, GMLC 122, orcarrier network 101 102, tasks the WLP 132, and provides the estimatedlocation to the LIMS 137 or GMLC 122. The WLG also provides an externalalarm feed to a customer's Network Operations Center (NOC) (not shown).

The EMS (EMS) 134 provides the network management for the locationequipment including configuration, performance management, status, andfault management.

The SCOUT™ Tool 135 is used to provision the Wireless Location System(WLS) which is made up of the LMU network 131 and SMLC cluster 140.

The Link Monitoring System (LMS) 136 extracts control messages betweenthe mobile device and the cellular network and provides triggers basedon network events to the WLG. The LMS 136 supports both network probesand radio probes.

The LIMS Client 138 is the Man-Machine-Interface (MMI) terminal used tooperate the LIMS and display outputs.

The LIMS EMS 139 provides network management over the LIMS 137, LMSserver and probes 136.

The SMLC 140 is the distributed cluster of location network servers forthe WLP 132 and WLG 133 functions.

The LMU-to-WLP Interface 141 is a digital data link either multiplexedover a switch circuit trunk or via IP-based transport such as Ethernet.

WLP-to-WLG Interface 142 is a high-speed Ethernet or Token Ringcommunications interface.

WLD-to-EMS Interface 143 is a Ethernet communications interface.

WLG-to-SCOUT Interface 144 is an Ethernet communications interface.WLG-to-LMS Interface 145 is a high-speed Ethernet or Token Ringcommunications interface.

The HLR SS7 connection 146 carries the D (from the MSC), G (from theSGSN), and Lh interfaces.

The GMLC SS7 network interconnection 147 includes the Lg interface forcommunication with the MSC 120 and SGSN 119 as well as the Lh interfacefor communication with the HLR 121.

The RAN Probe interfaces 148 which connect the LMS 136 to thedistributed wired or wireless probes are typically Ethernetcommunications interfaces.

The Core Network Probe interface 149 which connects the LMS 136 to theSS7 network probe(s) is typically an Ethernet communications interface.

The LIMS-to-WLG interface 150 is a high-speed Ethernet or Token Ringcommunications interface.

The LIMS-to-GMLC interface 151 is a high-speed Ethernet or Token Ringcommunications interface.

LIMS client interface 152 is typically an Ethernet communicationsinterface. LIMS EMS interface 153 is typically an Ethernetcommunications interface.

The metadata database interface 154 may be a high capacity, high speedinterface specifically designed as database storage interface such asFiber Channel or may be a more generic Ethernet type interface dependenton the capacity and local networking capabilities.

Historical database interface 155 is a high capacity, high speedinterface specific to database storage such as Fiber Channel.

The LMS-to-LIMS interface 156 a high-speed Ethernet or Token Ringcommunications interface.

The Radio Air interface 157 is the Um interface specified for GSM by theEuropean Telecommunications Standards Institute (ETSI) currently workingthrough the 3rd Generation Public Partnership (3GPP).

The Mobile Station 158 is may be a GSM-capable mobile device or may be amulti-mode GMS/GPRS/SMS voice and data mobile terminal With the additionof the UMTS mode, the Mobile Station 158 becomes known as a UE or UserEquipment.

Exemplary LIMS Network

FIG. 2 details an example of the LIMS network. In this example, the LMSs201 202 are separate from the LIMS deployment 200, although in practice,the functionality could be combined on the same server platform orcluster of servers. The LIMS and LMS are deployed in a 1-to-1 or1-to-many configuration based on needed capacity, number of wirelesscarriers to monitor, or geographic service area.

The LIMS controller 203 uses generic digital data interconnects to theLMS platforms 201 202. The controller 203 is both a packet router aswell as a firewall providing authentication and access control. As partof the router function the controller 203 performs event scheduling,packet filtering and inter-subsystem communications. Provisioning,monitoring and control of the LMS network 201 202 is also performed viathe controller 203 communications interfaces 211 212. Said controller203 also contains the aforementioned control logic and algorithms forgenerating complex triggers and may be a single or cluster of servers.

The controller 203 directs LMS obtained wireless network transactioninformation to database 204 via a high speed database interface 213.Additional information such as high-accuracy location, association data(metadata), and sensor fusion (such as image recognition, photos,videometric identity) data may be stored on additional databases 205that may be remotely housed or internal to the LIMS deployment 200 (asshown). The interface 214 to the other databases 205 is dependent ondeployment specifics but can take the forms of any of a number oflocal-area-network (LAN), wide-area-network (WAN) or database specificinterfaces.

The controller 203 allows for recovery of databased wireless networktransaction information from the database 204 via 213 via the genericEthernet interfaces 222 218 which interconnect the local user stations210 and remote user stations 207.

The LIMS deployment's Local Area Network 217 offers packet dataconnectivity to all subsystems under the controller's 203 rules. Thecontroller connects to the LAN 217 via Ethernet 216 as does the internallocation-based services applications server 209 via link 219 and the Mapdatabase 208 via data link 220.

The local user stations 210 and remote user stations 207 via thecontroller 203 and the associated packet data network 217 have access tothe databased wireless information 204, but also internal location-basedservices applications 209, external location-based services applications206 and digital mapping database(s) 208. The external applications 206and remote user stations 207 interconnections 215 and 216 may take theform of a variety of transport links which are translated by the Bridge223. The Bridge 223 also supports additional authentication, accesscontrol, monitoring, and intrusion security for the external or remotecomponents 206 207.

Illustrative Example of Complex Triggers—LIMS-IED Scan Feature

A LIMS user can pre-check a route that someone will soon travel forpotential mobile phone detonated LEDs or individuals waiting to ambush avehicle such as using a wired IED (or use of other weapons) alongspecific roads and areas. The LIMS user will draw geo-fence around routeto be taken. The LIMS will run a specialized algorithm that will firstlook back into the historical database 110 for a predetermined period oftime and create a list of all mobile devices that could have hadpresence in the area in the timeframe based on the best locationinformation available, available events and interpolation betweenevents, locations and timestamps. This will include mobile devices withlocation update events only (such as if idle and stationary) as locationupdates are periodic based on network operator configured timeouts. Thisconfiguration would be known and used in consideration of how far backin time the scan must look to determine potential mobile devices in thearea. Additionally, any mobile devices with recent activity appearing tolinger around area of interest or which turned the mobile device on oroff in conjunction with the above. Additionally, further enhancementssuch as use of known terrain features, commonly travel routes andpossible overlook points can be included in the analysis. This willcreate a list of candidate mobile devices that may be in the area andcan provide higher priority to devices that show a higher risk profilebased on user input data.

The LIMS algorithm will then use various means to automatically obtain ahigh accuracy location on each device on the list. Devices active on acall or data session can be immediately located and determined if stillin or near the area of interest. Devices not currently active can bestimulated by using advanced triggers such as ATI or NULL SMS, dependingon network type and supported capabilities, then high accuracy locationis possible on all such devices and this determines their immediatelocation. If they are still in the area, they will now show up on athreat list and map to the user with information on how long they havebeen there. The LIMS will then keep tracking these devices periodicallyuntil they leave the area of interest and any others that may enter thearea until the algorithm is disabled.

It is understood the above description of the algorithm is illustrativeand can be changed and enhanced to use any of the data sources mentionabove. It is also understood that this approach will have challenges inhighly populated areas where there are potentially thousands of mobiledevices in and around a define area of interest. So while this approachis most useful in less populated areas, is can be tuned and enhanced towork in more populated areas via the same means. In this case, the humanuser may have more a larger threat list to analyze and make a judgmentcall. In all cases, the resulting information is useful is assessingrisk and potential threats along a route before it is traveled. Theseresults can tell the user where there is a potential IED on a roadside(mobile device detonated IED) or where there is one or more lookoutssitting idle along a road where there may be a manual IED or otherambush planned. The users can then utilize the provided information asthey deem fit, such as identifying an alternative route with less risksidentified, or directing other surveillance technologies to the area tovalidate the information, or even testing the device as follows.

Illustrative Example—Remote IED Detonation

In the above example, if there has been potential mobile devicedetonated IEDs identified based on the LIMS provided information,alternative intelligence and or human intelligence, the user can decideto use the LIMS to stimulate the potential mobile device detonated IEDby sending it a normal SMS or placing a call to the mobile device. If itis a typical mobile device detonated IED this will cause it to detonatein a controlled manner. If the device was not an IED, then no harm wasdone.

FIG. 3 illustrates using the LIMS for detecting a command-detonated IEDscenario as well as detailing the general LIMS enabled features used inthe analysis of historical and real-time data. The LIMS network (whichincludes the LMS) is deployed in a carrier network (or multiple carriernetworks). The LMS component is pre-set with a set of triggers thatpassively capture a selection of network events 301. These triggersinclude mobile-origination, mobile-termination, location update, IMSIattach and IMSI detach and can include additional mid-call eventtriggers such as Network Measurement Report (NMR). This backgroundpassive monitoring and databasing of events continues on an indefinitebasis. The LIMS can add or delete network transaction triggers in theLMS at time as needed to facilitate the complex associative triggersused in the analysis software such as the DSS in the LIMS.

When an area (such as a roadway) is to be secured, the user determinesthe geographic area to be secured and the time window for the operation302. The LIMS, in response, starts a parallel series of operations.First, a historical analysis of monitored events from the historicaldatabase begins 303. Secondly, a real-time analysis of current activityin the selected area is started 304. For both the real-time andhistorical analysis, the best available location derived from thecellular system information (cell-id, sector, timing and or power-basedranging) in the current or historical monitored information is used tofind mobile devices locations in the approximate area in and round theselected geographic area.

Once the first, rough set of mobile's identities and locations aredetermined, the LIMS schedules its attendant high-accuracy PositioningDetermining Equipment, sets internal filtering and triggering, and thensilently polls the first set of mobile devices (this active, silentpolling uses the AnyTimeInterrogation (ATI) or null-SMS capabilityprovided by the SMS-C or the GMLC (in CAMEL Phase III, IV). Highaccuracy location includes TDOA, AoA, TDOA with AoA and hybrids.

Using the LMS and PDE, the network transaction triggering and associatedradio uplink transmissions are detected and a high accuracy location isperformed 307. It is the LIMS' responsibility to schedule the PDEresources and active polling as to optimize the location rate, locationaccuracy (possible retries may be needed) and location over the selectedarea (for instance, the LIMS may schedule mobile devices closer to thestart of a route first, or mobile devices with the highest possibilityof being next to the route).

As high accuracy locations become available, the LIMS begins analysis ofthe high accuracy location historical behaviors. The LIMS removes mobilefrom the first list that are not in proximity to the route. Since newmobile devices may enter the selected area at any time, the real-timeanalysis 304 can cause additional scheduling of high accuracy resources305, active polling 305 and high accuracy location 307 at any time inthe selected time window. Using the rules based decision support system,the newly refined second list of mobile devices is analyzed forsuspicious behaviors and location proximity to the route 308 (forinstance, a mobile phone that has never made a call since power-up is inclose proximity to the road through multiple periodic registrationcycles is flagged). The DSS prioritizes suspicious mobile devices andpresents the entire second list of mobile identifiers, locations, andpriority to the user 310 as a threat list. The user can then select froma variety of options detailed above. The LIMS and attendant subsystemscontinue operation until the time window closes or the present operationis discontinued by the user. Events generated by the LMS in response tothe initial set of triggers or additional sets of triggers within theLIMS as well as the high accuracy locations generated all get stored inthe historical database indexed by time, mobile identifiers, event, andlocation metadata generated during the analysis by the LIMS is stored inthe metadata database which could be indexed by time, mobileidentifiers, event, and location, relationship and priority for futureuse or review. Using the delivered risk assessment, the user can choosea to disable the mobile device 311 via several methods. Working with thelocal wireless operator, the mobile device can be denied further networkaccess. The device may be messaged (short message service (SMS), orcalled since the identity including the dialable directory number isknown (perhaps resulting in detonation). Alternately, local personnelcan be vectored to the position for manual observation and disablement.If not disabled, the device may be monitored for addition radio activityby the LIMS, or placed under observation by local personnel, aerialassets, or video means.

Illustrative Example—Relational Based Triggers

In many scenarios, it is desired to gain information on associates of anindividual and their corresponding mobile device. One such was toautomatically obtain this is via LIMS where it can set relational basedtriggers. One example of a relational based trigger is any device thatmakes contact with a specific device, denoted by a unique ID (such asIMEI, IMSI, and MSISDN). When the other device sends (or receives) anSMS, data message or phone call to (or from) the specific device, theLIMS can trigger high accuracy locations on the other deviceinstantaneously. This could be used to allow a potential IED to bedetonated by sending a “decoy” to the area while having set the LIMS todo a relational trigger on this device. When the IED goes off, the LIMSwill immediately locate the calling/sending device and provide theinformation to the LIMS users. Even if the calling subject turns off thedevice immediately thereafter, having high accuracy location informationon the calling subject immediately is very useful information as nearbyresources can be deployed or other mobile devices in the proximity canbe flagged as potentially belonging to the same subject or associatesthereof and then tracked. If the actual trigger device is not turnedoff, it can then be tracked via high accuracy for a user define periodof time. In both cases, the tracking of such devices could enablecollection of additional information and the apprehension of thesuspect.

In general, this could automatically be extended using relational basedtriggers to then automatically obtain high accuracy locations andinformation on any other mobile devices that communicates with thisdevice such as through SMS or calling. This can be iterative and thenproduce a set of relational data that is stamped with high accuracylocations of each device in the list at the time of transaction andoptionally thereafter. Another example of relational based triggers iswhen two or more mobile devices remain in the proximity of one another(even if the said devices never communicate directly between oneanother), and once validate using high accuracy, appear to be associatedbased on various correlative techniques such as being together whenmoving fast along a road (in a car together) and tend to remain togetherfor periods of time while moving around.

The LIMS could determine potential candidates for this type of matchbased on algorithms based on lower accuracy information and then triggerhigh accuracy location as needed to validate or invalidate potentialmatches. This could be based on a known mobile device, (such as a knownmobile and look for other mobile devices that correlate geographicallyin time) or could be a completely random brute force approach (LIMSlooks into historical database and randomly finds and determinesmatches) or geographically based (devices that frequent certain areas tobe used as a starting point and then seek to find others thatcorrelate). Once the LIMS has determined geographical association withtwo or more mobile devices with a high probability, the LIMS user canthen be alerted and the metadata created stored for later use.

Illustrative Example—Behavior Based Triggers

Another aspect of the LIMS capability is in the detection of behaviorsof interest and identifying specific mobiles or mobile users associatedwith such behaviors of interest. These behavioral complex triggers usethe LIMS capabilities, such as, e.g., the previously cited U.S. Pat. No.7,783,299, “Advanced Triggers for Location-based Service Applications ina Wireless Location System,” that allow for radio or network events(corresponding to specific messages or groups of over-the-air,inter-network or intra-network messaging) to generate high and/or lowaccuracy location estimates. A triggering event, one that initiateslocation estimation, may be a detection of a particular message or afield within a specific message. Examples of detectable network or radioevents (also called network transactions) in a wireless communicationsnetwork include: (1) Mobile originations/terminations; (2) SMSoriginations/terminations; (3) Mobile Attach/Detach (packet data)events; (4) Registration/Location/Routing Update (that is, a “location”update for the purposes of mobility and roaming as opposed to anetwork-based (U-TDOA, AoA, ECID) or mobile-based (A-GNSS, GNSS, OTDOA,ECID) location event; (5) Handovers; and (6) Call Releases.

Over time, a database of historical information is developed (collectionphase) of mobile identifiers and triggered events. The data collectionphase may target any mobile device, any set of mobile devices, or aspecific area in the wireless communications network (WCN) service area.Selection of a mobile device may be by any of the detectable mobile ornetwork identifiers associated with the mobile device.

Data from the collection phase is then analyzed for suspect behaviorsand an index probability is assigned to each mobile. The Analysis phasemay include information imported from off-line, non-wireless sources.The Analysis phase may be performed automatically periodically, ad hocin response to a set triggering event, or manually at any time.

Illustrative Examples of Advanced LIMS Scenarios

These illustrative examples are used to highlight the capabilities ofthe LIMS. Both network-based (U-TDOA, AoA, ECID) or mobile-based(A-GNSS, GNSS, OTDOA, ECID) wireless location techniques may be used toaccomplish geo-location of mobile devices. Selection of the wirelesslocation technique may be based on the mobile device's capabilities, theserving wireless communication network's capabilities or the operator'sdiscretion.

Area Presence Determination

In this illustrative example, the site (area of interest (AOI) could beat a construction site or other area where users wish to insure thereare likely no mobile devices in the area prior to an event, such asdemolition of a building.

FIRST STAGE—(Historical scan) The LIMS can use a historical view of anyand all mobile devices that could have been in the area in the last Xhours (where X is a variable) based on low accuracy historical data. Itcan then use the most recent event that was possibly in the area ofinterest, and check to see if there is a more recent event showing theparticular mobile device was somewhere else outside of the area ofinterest, showing it likely moved away. This would eliminate this mobiledevice from consideration.

SECOND STAGE—(final determination if in Area of Interest AOI)—Othermobiles that show recent events that could be in the area of interestand do not show more recent events farther away, can then be consideredas possibly in the AOI. The LIMS can then automatically ping thesemobile devices in real time using high accuracy and determine if theycurrently are or are not in the AOI. If any mobile devices are, theycontinue to be tracked using high accuracy.

THIRD STAGE—(continue to scan for a period of time Y (where Y is avariable))—The LIMS can then continue to monitor the AOI and trackmobile devices known to be in the area using high accuracy. In addition,any new events that occur where the mobile device could be in the AOIare located using high accuracy and are either eliminated fromconsideration or added to the list of mobile devices in the AOI.

FOURTH STAGE—(steady state determination)—After a period of time Y, theLIMS can be reasonably sure what mobiles are in the AOI as long as thescan time “Y” is longer than the typical periodic location update timeof the networks. NOTE: this does not guarantee there are no other mobiledevices in the AOI as they could have entered the AOI in an idle statesince the last periodic location update time, but it does provide a wayto scan for a majority of likely mobiles in the target area in anautomatic fashion.

Association by Proximity

(A) Synchronous Geo-Profile Correlation—One Person, Multiple MobileDevices

LIMS can use location information to associate two or more mobiledevices as being associated even if these mobiles devices never call ortext each other. Historical information can be mined to find mobileswith highly correlated geo-profiles as a function of time. Such mobileswould exhibit essentially the same location profile over a time rangebut may not have any specific events linking them together except forapproximate location.

Collection and Analysis can be done over a longer time range to increasecorrelation and show that these 2 (or more) mobile devices may be beingcarried by the same person, and hence knowing the identity of one nowprovides the identity of the other and can be linked in link analysis.Also high accuracy surveillance can be enabled on these two mobiles fora period of time to further validate this association for a period oftime.

(B) Synchronous Geo-Profile Correlation—Associates

The LIMS system can further determine that 2 (or more) mobiles may behighly location correlated for periods of time but then are clearly notat other periods of time. This indicates the two persons are associatesand spend time together (meetings at static locations or moving aroundtogether) but at other times (such as night) go to different locations.

High accuracy surveillance can then be used by the LIMS to validate thisassociation as well as the periods where they are apart. These twomobiles may never call each other thus such association would not beavailable through traditional call analysis. This could be forvalidating employees are working together during the day as they aresupposed to, such as a delivery team, or police officers sharing apatrol car.

(C) Asynchronous Geo-Profile Correlation—Indirect Associates

Here, a specific mobile device may exhibit a geo-profile and there maybe one or more mobile devices that have a very similar profile but atdifferent times. This could be used to determine that 2 or more mobilesfrequent the same sites but at different times, perhaps on differentshifts. This shows an indirect association between the specific mobiles,such as dump truck drivers bringing loads of dirt from a constructionsite to a fill area, and that others exhibit the same location behaviorbut out of synch with each other with respect to time. Or the dump truckdriver may work an 8 hour shift and another driver is traversing thesame route during the next 8 hours. In this case, the association isthey have the same job. Here again, the associated high accuracywireless location system can be used to validate this assumption.

(D) Phone ID Determination

Many prepaid phones have no user identity associated with them, exceptfor the dialable numbers. As discussed in TruePosition's United StatesPatent Application, “Multi-Sensor Location and Identification, Ser. No.12/633,672, even if local or national authorities require userregistration for prepaid phones, there will always be fraud or blackmarkets for such devices. The user of a specific mobile may be able tobe determined by their geo-profile. Information such as where they tendto spend the night and where they are during the day can be added to thecall information available to help identify the owner/user of a specificmobile.

Avoidance Tactics Detection

The LIMS can be used to detect avoidance strategies used by thoseattempting to avoid being detected.

Prison Phone Use

One such example is a prisoner who has a smuggled a phone into a jailfacility. The prisoner will only turn the phone on for a brief time,make a call or two (or send/receive text messages) and then shut it off.The LIMS can mine the historical database for such behavior patterns andthen create a list of candidate phones that exhibit such behaviors. Highaccuracy surveillance can then be used when such phones are used againto determine the exact location of where this activity is taking place.This will indicate if this mobile is in a prison or area where phone useis restricted. LIMS can also send real-time automated alerts toauthorities so they can take quick action.

General Avoidance—Signaling

If the phone exhibits the above behavior but in different locations,then it is not a prisoner but may be an indication of illicit behavior.LIMS can then mine the historical information and look for other mobilesthat are in the same areas at the same time on a statistical basis todetermine possible other associates (above) or if this person iscarrying two phones. The two phones can then be looked at for additionalcorrelations, such as one is always on and when it receives a call ormessage from a number, the user turns on the other phone and makes acall or sends a message to a specific number. The first phone is used asa signal and the second phone is used for the communication.

General Avoidance—Limited Duration Disposable Mobile Devices

A person uses a different prepaid phone every week. Also each week,his/her associates change phones so they are never the same phonenumbers used for more than a week. LIMS can detect this behavior byanalyzing collected information from the LIMS database for suchbehaviors and associate it to the numbers called to/from.

A geo-profile of such mobiles can then be built and used to predict whenand where the switchover to new devices will occur. Then the new devicescan be determined quickly and the user or group of users can be trackeddespite their efforts to avoid detection.

High accuracy location can then be used to provide additional detail onthe behavior of such individuals and their associates and provide for afaster and more accurate correlation to new devices when switched.

Kidnapping Scenario

In this scenario, the kidnapper carries two mobile devices (in thisexample mobile phones), a primary phone “A” that he uses to communicatewith his accomplice or boss, and secondary phone “B” which is athrow-away phone. In some cases, the “B” phone may be the victim's owncell phone or a stolen phone.

The kidnapper uses phone “B” once and throws it away. The goal of thisprocedure is to identify phone “A” and network identifiers or limit thenumber of possibilities for phone “A”. Given that the LIMS tool may beconfigured to collect and archive all network events in the service areato the database, the LIMS system can execute the following procedure:

-   -   1. A kidnapper calls using phone B for ransom at time T1. We can        immediately identify the phone B identifier and locate the phone        at time T1, The resulting low-accuracy (cell-based) location is        denoted Location L1. (Note: Kidnapper tosses phone B—he has no        more use for it.) This first step can be either in real-time        location with knowledge of the past kidnapping event or in        post-event analysis using LIMS given the dialed number and the        known time T1.    -   2. The LIMS operator sets up a data mining campaign C1. This        campaign will be centered around location L1 at time T1 plus or        minus the location update set by the network (let us assume it        is half an hour). This campaign will capture all phones that are        possibility in close proximity with phone B at time T1. (Note        that phone A will be one of these phones.)    -   3. The next day or hours later, the kidnapper uses another        throw-away phone “C” to communicate with the kidnappee family at        time T2 for ransom.    -   4. We can immediately identify phone “C” identifier and locate        the phone at time T2, and the resulting location is denoted        Location L2. (Note Kidnapper tosses phone “C”—he has no more use        for it.)    -   5. The LIMS operator sets up a second data mining campaign C2,        This campaign will be centered around location L2 at time T2        plus or minus half an hour. This campaign will capture all        phones that are in close proximity with phone C at time T2.        (Note that phone A will also be one of these phones.)    -   6. Now we look at the intersection of mobile and network        identifiers of C1 and C2. LIMS provides an automated tool to        perform this identifier intersection operation.    -   7. The LIMS result should identify a small set of identifiers        that are located at L1 at Time T1 and L2 at time T2. Note that        phone A is part of this set.    -   8. At this time all matches are possible targets, or if there is        a third or subsequent call, the LIMS operator can repeat the        identifier intersection operation and results from a Campaign C3        (or additional) to identify a single target.

Secondary Triggers for General Surveillance:

Once the LIMS device is deployed into a service area, specifictriggering events may be established to alert operators of suspiciousbehavior or threats. Location surveillance of specific mobiles can betriggered by additional conditions, such as:

1) When they enter or leave a specific area such as a job site. Usingthe LIMS, a geo-fenced Area-of-Interest is established and a set ofmobile identifiers associated with that AOI is provided. Mobile devicesthat execute a network transaction within the AOI are detected as arethe pre-set mobile identifiers. Using the network events associated withthe AOI and the network events associated pre-set mobile identifiers,entry and exit from the AOI may be determined and surveillance may beactivated or de-activated.

2) When they make/receive a call/text to/from another mobile device thatis under surveillance. Using the LIMS, a primary trigger is establishedbased on a suspect mobile device's identifier(s) and dialable number.Any mobile phone that contacts (via messaging, data connection or voicecall) to the suspect mobile is then added as a trigger for surveillance.

3) As a function of day and time (e.g., only perform surveillance onmobile when they are supposed to be working). Using the LIMS, ageo-fenced Area-of-Interest is established and a set of mobileidentifiers is associated with that AOI. Mobile devices that execute anetwork transaction within the AOI are detected as are the pre-setmobile identifiers. Using the network events associated with the AOI andthe network events associated with pre-set mobile identifiers, entry andexit from the AOI may be determined and surveillance may be activated orde-activated based on that condition and the local time-of-day.

4) If they turn their phones on, make calls (or texts) and turn off.This secondary trigger is based on a repeated sequence for a mobiledevice, specifically, the mobile device preforms a power upregistration, sends messaging, establishes and completes a data sessionor makes a voice call, but few (or no) periodic or other registrationsare associated with the mobile device and a power-down de-registrationis detected. The LIMS may be set to detect and automatically locate suchmobile devices based on this secondary trigger.

5) If they turn their phones on, make calls (or texts) and turn off byremoving the battery. This secondary trigger is based on a repeatedsequence for a mobile device, specifically, the mobile device preforms apower up registration, sends messaging, establishes and completes a datasession or makes a voice call, but no periodic or other registrationsare associated with the mobile device and no power-down de-registrationis detected. The LIMS may be set to detect and automatically locate suchmobile devices based on this secondary trigger.

6) They, the caller, use failed originations to signal the callee. Thecallee then originates a second call to the original caller or a thirdparty. The LIMS system detects the incomplete first origination and setsa trigger so that any secondary follow-up call placed back to the firstoriginating phone or to a third party can be detected, identified,located, and logged. In contrast, use of billing records or call detailrecords (CDRs) cannot identify this scenario since incomplete callinformation is normally not retained by the wireless communicationsnetwork operator.

7) They forward calls via a relay device. As an example, a suspectcarries wireless device “A” but he does not disclose the phone number toanyone, instead he sets up a second communications device “B” (Entity“B” could a be wireless device, could be landline station or aVoice-over-IP facility) to call forward all incoming calls from device“B” to Mobile device “A”. Note that device “B” could be set up remotely,could be a virtual device running as an application on a mobile or fixedcomputing device or it could be a real mobile device with the requisiteforwarding mechanism setup thru the wireless or wired network operatorfacilities.

When an agent or agency knows device “B” but would like to discoverMobile device “A” and the location of the suspect possessing the “A”mobile device, the LIMS system may be used to discover mobile device “A”identifiers (e.g. the phone number, serial number, etc.) and itslocation. In this example scenario, a mobile device “C” sets up a call,sends a message or creates a data session with to device “B”. Mobiledevice “C” may be an unknown 3^(rd party mobile device or one used by the agent or agency controlling the LIMS system.)

In this scenario;

Step 1—Discover Mobile device C in real time: The agents sets up a queryin real time to discover all mobile devices that perform Mobileorigination Voice or Text with dialed digits showing device B. Theresults set will contain Mobile device C as the latest record.

Step 2—Discover Mobile device A. Now that we know Mobile device C, theagent sets up a query in real time to discover all mobile devices thatreceive a mobile device call or Text from Mobile device C. The resultsset will contain Mobile device A as the latest record and itsappropriate location.

Since the agent/agency does not know if device “B” has been forwarded ornot, one way to establish that ‘this is the case’ is to perform alocation request in deployed and using un-deployed areas to eliminatethese possibilities.

All of the above procedures could be performed in an automated format ormanually. A similar procedure could be established for call spoofing(meaning, dial a number from Mobile device “A” to Mobile device “C”,mobile device “C” receives a call from mobile device “B”. The agent onlyknows mobile device C and would like to locate all mobile devices thatcalls or messages mobile device “C”.

In this scenario, the target has call spoofing set up, the agent sets upa query in real time to discover all phone numbers that performedincoming calls or text to mobile device C. Phone number B would be themost recent number. Knowing phone number B, the agent can set up a queryto identify all devices that perform mobile origination (text or voice)to phone number B. The result set will contain mobile device A (thetarget) which is the latest record and its appropriate location.

Conclusion

The true scope the present invention is not limited to the presentlypreferred embodiments disclosed herein. For example, the foregoingdisclosure of a presently preferred embodiment of a Wireless LocationSystem uses explanatory terms, such as LMS (Link Monitoring System, RNM(Radio Network Monitor), Serving Mobile Location Center (SMLC), LocationMeasuring Unit (LMU), and the like, which should not be construed so asto limit the scope of protection of the following claims, or tootherwise imply that the inventive aspects of the Wireless LocationSystem are limited to the particular methods and apparatus disclosed.Moreover, as will be understood by those skilled in the art, many of theinventive aspects disclosed herein are based on software applicationsrunning on generic hardware processing platforms. These functionalentities are, in essence, programmable data collection and processingdevices that could take a variety of forms without departing from theinventive concepts disclosed herein. Given the rapidly declining cost ofdigital signal processing and other processing functions, it is easilypossible, for example, to transfer the processing for a particularfunction from one of the functional elements (such as the LIMS)described herein to another functional element (such as the SMLC)without changing the inventive operation of the system. In many cases,the place of implementation (i.e., the functional element) describedherein is merely a designer's preference and not a hard requirement.Accordingly, except as they may be expressly so limited, the scope ofprotection of the following claims is not intended to be limited to thespecific embodiments described above.

1. A location information management system (LIMS), comprising: acontroller computer (203); and one or more databases (203, 204)operatively coupled to the controller computer and configured to storenetwork event historical data and metadata; wherein the LIMS isconfigured to utilize the network event historical data and the metadatato produce location-aware intelligence including geo-profiles for mobiledevices, wherein said geo-profiles include location and time informationfor said mobile devices.
 2. A LIMS as recited in claim 1, wherein theLIMS is configured to be coupled to a link monitoring system (LMS), andto store wireless network transaction information obtained by the LMS,and to store additional information including high-accuracy locationdata, association data, and sensor fusion data.
 3. A LIMS as recited inclaim 2, wherein the sensor fusion data includes image recognition data,photographic data, and videometric identity data.
 4. A LIMS as recitedin claim 2, wherein the LIMS is further configured to: analyze past andreal time data to produce intelligence in the form of metadata, and tostore the metadata; and iteratively use previously generated metadata toautomatically contribute to new analysis that uses both real data andmetadata, wherein said new analysis produces information including:identification of potential behaviors of interest, identification ofspecific mobile users associated with said behaviors of interest,associations between mobile device users, and mobile device useridentification.
 5. A LIMS as recited in claim 4, wherein the LIMS isfurther configured to determine when a specific wireless location needsto be obtained, how accurate the specific wireless location needs to be,and where to best obtain the specific wireless location.
 6. A LIMS asrecited in claim 5, further comprising a decision support system (DSS)software application capable of automatically deciding when to require ahigh accuracy location versus a lower accuracy location.
 7. A LIMS asrecited in claim 6, wherein the DSS application uses rules, databasedlocation, identity, and transactional information to determine a set ofscenarios based on a prioritized set of situational data that determinemetadata including relationships between users, mobile devices,locations of interest, and other mobile devices.
 8. A LIMS as recited inclaim 7, wherein the LIMS is further configured to use multidimensionalhistograms of activity and locations with dynamic conditional logic todetermine association by proximity, and to use this information as atriggering event.
 9. A LIMS as recited in claim 8, wherein the LIMS isfurther configured to use location as a proxy to identify users andrelationships between users, groups and locations of interest.
 10. ALIMS as recited in claim 9, wherein metadata analysis is used to compilean iterative risk profile for mobile devices.
 11. A LIMS as recited inclaim 10, wherein mobile devices identified as having a high riskthreshold are subjected to additional scrutiny.
 12. A LIMS as recited inclaim 11, wherein the one or more databases contain(s) events fromtriggers, said events including mobile identifiers including IMSI, IMEI,MS-ISDN, and TMSI identifiers, event details including called number,calling number, and message type, and location information gleaned fromwireless network parameters obtained from event reports.
 13. A LIMS asrecited in claim 12, wherein the LIMS is further configured to createcomplex triggers from a combination of real time flow of mass data intooperating algorithms, past network event historical data, past metadataand user provided data.
 14. A LIMS as recited in claim 13, wherein theLIMS is further configured to use a mobile device's calling pattern andhistory for analysis, and to use non call-related information, includingregistrations and location updates, to recognize suspicious behavior andevents.
 15. A LIMS as recited in claim 14, wherein the one or moredatabases include(s) records on both messaging-related and wirelesscommunications network control events including location updates,handovers, power up IMSI (International Mobile Subscriber Identity)attaches, and power down de-registrations.
 16. A LIMS as recited inclaim 15, wherein trigger information and other data is processed by theDSS with a set of if-then-else rules combined with databased informationon events, time-of-day, and geofence boundaries to create metadata,wherein the metadata allows the LIMS to perform analysis where thelocation of a mobile is used as a proxy to identity, purpose andrelationships with other mobile users.
 17. A LIMS as recited in claim16, wherein the one or more database(s) contain(s): information onnetwork event transactions that occur in a covered area for a set ofmobile devices, including selected information for each event includingall available known identifiers of the specific mobile; event-relatedinformation including information about events including handover,mobile originated call, SMS (Short Message Service) received, dialeddigits, and timestamps; event-related network information; and metadatafor each specific event that includes a calculated location.
 18. A LIMSas recited in claim 17, wherein the LIMS is further configured to store:information input by users, including map information and networkinformation including cell site locations, antenna information, andlocation results for specific algorithms that have run in the past. 19.A LIMS as recited in claim 1, wherein the LIMS is further configured tostore in said one or more databases information from multiple sources,including a wireless network, a wireless location network, and off-linesources providing network information, geographic information, manuallyentered information and geo-spatial data.
 20. A LIMS as recited in claim1, wherein the LIMS is further configured to detect predefined behaviorsof interest and to identify specific mobile devices or mobile usersassociated with said predefined behaviors of interest.
 21. A LIMS asrecited in claim 20, wherein the LIMS is further configured to respondto predefined triggering events by acquiring high and/or low accuracylocation estimates, wherein said predefined triggering events includedetection of at least one of the following types of network transactionwithin a wireless communications network: (1) MobileOriginations/Terminations; (2) Short Message Service (SMS)Originations/Terminations; (3) Mobile Attach/Detach events; (4)Registration/Location/Routing Update; (5) Handovers; and (6) CallReleases.
 22. A LIMS as recited in claims 21, wherein the LIMS isfurther configured to collect mobile identifiers and triggered events;store the collected data; analyze the collected data for suspectbehaviors; and assign an index probability to each of a plurality ofmobile devices.
 23. A LIMS as recited in claim 1, wherein the LIMS isfurther configured to perform an Area Presence Determination process fordetermining whether a specific mobile device was present in anarea-of-interest (AOI) at a specific time, wherein the Area PresenceDetermination process comprises: performing a historical scan in whichlow accuracy historical data is analyzed to identify first and secondmobile devices that could have been in the AOI within a defined timeperiod based on the detection of first and second events associated withthe first and second mobile devices, respectively, wherein the first andsecond events are determined to have occurred prior to the defined timeperiod, and then identifying the second mobile device as being somewhereelse outside of the AOI at the specific time based on the detection of athird event, wherein the third event is determined to have occurredafter said second event.
 24. A LIMS as recited in claim 1, wherein theLIMS is further configured to use location information to identify firstand second mobile devices as being associated based on the first andsecond mobile devices having highly correlated geo-profiles as afunction of time.
 25. A LIMS as recited in claim 24, wherein the LIMS isfurther configured to perform high accuracy surveillance to validatethat said first and second mobile devices are associated and to identifyperiods of time when they are apart.
 26. A LIMS as recited in claim 24,wherein the LIMS is further configured to use location information toidentify the first and second mobile devices as being indirectlyassociated based on the first and second mobile devices havinggeo-profiles that are similar but offset in time.
 27. A LIMS as recitedin claim 1, wherein the LIMS is further configured to identify a user ofa specific mobile device based on a geo-profile of the specific mobiledevice.
 28. A LIMS as recited in claim 1, wherein the LIMS is furtherconfigured to detect avoidance strategies based on analysis ofhistorical data and detection of predetermined behavior patternsassociated with a first mobile device, and to employ high accuracysurveillance to determine a precise location of where said behaviorpatterns are taking place.
 29. A LIMS as recited in claim 28, whereinthe LIMS is further configured to identify a second mobile deviceassociated with the first mobile device based on the second mobiledevice being present in the same areas as the first mobile device duringthe same time periods.
 30. A LIMS as recited in claim 1, wherein theLIMS is further configured to detect a user's behavior pattern of usinga different prepaid mobile device in different time periods and creatinga geo-profile of the mobile devices, and using the geo-profile topredict when and where a switchover to a new mobile device will occur.31. A LIMS as recited in claim 1, wherein the LIMS is further configuredto: identify a first mobile device and determine a first location (L1)of the first mobile device at a first time (T1), wherein the firstmobile device is identified as having placed an unlawful call; perform afirst data mining campaign centered around location L1 at time T1 toidentify a first set of mobile devices that were in proximity to thefirst mobile device at time T1; at a second time (T2), identify a secondmobile device and determining a second location (L2) for the secondmobile device, wherein the second mobile device is identified as havingplaced a second unlawful call; perform a second data mining campaigncentered around location L2 at time T2 to identify a second set mobiledevices in proximity to the second mobile device at time T2; anddetermine an intersection of the first and second sets of mobile devicesand identify a third mobile device located at L1 at time T1 and at L2 attime T2.
 32. A LIMS as recited in claim 1, wherein the LIMS is furtherconfigured to: identify a first mobile device and determine a firstlocation (L1) of the first mobile device at a first time (T1), whereinthe first mobile device is identified as having placed an unlawful call;at a second time (T2), identify a second mobile device and determining asecond location (L2) for the second mobile device, wherein the secondmobile device is identified as having placed a second unlawful call;perform a data mining campaign to identify first and second sets ofmobile devices that were in proximity to the first mobile device at timeT1 and in proximity to the second mobile device at time T2; anddetermine an intersection of the first and second sets of mobile devicesand identify a third mobile device located at L1 at time T1 and at L2 attime T2.
 33. A LIMS as recited in claim 1, wherein the LIMS is furtherconfigured to carry out the following process to establish triggeringevents and alert an operator of suspicious behavior: establishing ageo-fenced area-of-interest (AOI) and identifying a set of mobile deviceidentifiers associated with the AOI; detecting a first mobile devicethat executes a network transaction within the AOI; activatingsurveillance based on entry into the AOI by the first mobile device;detecting that the first mobile device is communicating with a secondmobile device that is currently under surveillance; establishing aprimary trigger based on an identifier and dialable number associatedwith the second mobile device; and establishing a trigger forsurveillance of a third mobile device that communicates with the secondmobile device.
 34. A LIMS as recited in claim 33, wherein surveillanceis limited to specified times of day.
 35. A location informationmanagement system (LIMS), comprising: a controller computer and one ormore databases operatively coupled to the controller computer; whereinthe LIMS is configured to utilize network event historical data andmetadata to produce location-aware intelligence including geo-profilesfor mobile devices, wherein said geo-profiles include location and timeinformation for said mobile devices; wherein the LIMS is furtherconfigured to detect predefined behaviors of interest and to identifyspecific mobile devices or mobile users associated with said predefinedbehaviors of interest; wherein the LIMS is further configured todetermine whether a specific mobile device was present in anarea-of-interest (AOI) at a specific time; wherein the LIMS is furtherconfigured to use location information to identify at least two mobiledevices as being associated based on geo-profiles associated with the atleast two mobile devices; and wherein the LIMS is further configured todetect avoidance strategies based on analysis of historical data anddetection of predetermined behavior patterns associated with a mobiledevice, and to employ high accuracy surveillance to determine a preciselocation of where said behavior patterns are taking place.
 36. A LIMS asrecited in claim 35, wherein the LIMS is further configured to employ anArea Presence Determination process comprising: performing a historicalscan in which low accuracy historical data is analyzed to identify firstand second mobile devices that could have been in the AOI within adefined time period based on the detection of first and second eventsassociated with the first and second mobile devices, respectively,wherein the first and second events are determined to have occurredprior to the defined time period, and then identifying the second mobiledevice as being somewhere else outside of the AOI at the specific timebased on the detection of a third event, wherein the third event isdetermined to have occurred after said second event.
 37. A LIMS asrecited in claim 35, wherein the LIMS is further configured to carry outthe following process to establish triggering events and alert anoperator of suspicious behavior: establishing a geo-fencedarea-of-interest (AOI) and identifying a set of mobile deviceidentifiers associated with the AOI; detecting a first mobile devicethat executes a network transaction within the AOI; activatingsurveillance based on entry into the AOI by the first mobile device;detecting that the first mobile device is communicating with a secondmobile device that is currently under surveillance; establishing aprimary trigger based on an identifier and dialable number associatedwith the second mobile device; and establishing a trigger forsurveillance of a third mobile device that communicates with the secondmobile device.